Privacy Notice

Creative Automated Simulations ("we", "us") is the data controller for personal data processed through Track My Keys. You can contact us at hello@track-my-keys.com.

We collect only what we need to run the service.

• Account data — name (optional), email address, hashed password, authentication tokens.
• Workspace data — the business name, branding, properties, addresses, notes, key sets, QR tokens, codes and audit-trail events that you and your team enter.
• Team data — emails of teammates you invite, their role (admin/staff), and when they joined or were removed.
• Technical data — IP address, device and browser type, timestamps, and basic request logs used for security, debugging and abuse-prevention.
• Support communications — the contents of emails you send us.

We do not knowingly collect data from anyone under the age legally required to provide consent in their country. Track My Keys is not directed to children.

• To provide the service (performance of a contract) — accounts, sign-in, storing and displaying your workspace data, sending operational emails.
• To keep the service secure (legitimate interests) — preventing fraud, abuse, unauthorized access and ensuring fair use of capacity limits.
• To improve Track My Keys (legitimate interests) — diagnosing errors, measuring feature usage in aggregate.
• To handle support (performance of a contract / legitimate interests) — responding to your questions and tickets.
• To comply with law (legal obligation) — for example, retaining invoice records or responding to lawful requests.

We share personal data with the following categories of recipients only as needed:

• Merchant of Record — Paddle.com: handles checkout, payment, billing, tax compliance, invoicing, refunds and subscription management. See Paddle's privacy policy .
• Infrastructure and hosting providers: cloud database, authentication, edge compute and storage providers that host Track My Keys.
• Email delivery: transactional email providers used to send invites, password resets and operational notifications.
• Professional advisers: lawyers and accountants where strictly needed.
• Authorities: where required by law, court order, or to protect our rights, users or the public.

We do not sell your personal data and we do not share it for cross-context behavioral advertising.

Our service providers may store and process data outside your country of residence, including in jurisdictions that may not provide the same level of data protection. Where applicable we rely on appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions) to protect transfers.

• Active accounts: for as long as your account is active.
• Workspace data: until you delete it or delete your business; admins can permanently delete a business from Settings → Danger zone, which removes properties, key sets, history, members and invites.
• Billing records: kept by Paddle for the period required by tax and accounting law.
• Backups and logs: deleted within a rolling retention window (typically 30–90 days).

After deletion, residual copies in backups will be overwritten in due course.

Subject to applicable law (such as GDPR for EEA/UK users), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") where applicable.
• Restrict or object to certain processing.
• Receive your data in a portable format. Admins can export the full business JSON directly from Settings → Danger zone.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, email hello@track-my-keys.com. We aim to respond within one month.

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), encryption at rest at the database layer, row-level access controls so businesses cannot read each other's data, and role-based permissions inside each business. No system is perfectly secure; you can help by using a strong, unique password.

Track My Keys uses cookies and local storage that are strictly necessary to run the application — for example, to keep you signed in. We do not use third-party advertising cookies. Paddle's checkout may set its own cookies as described in its privacy policy.

If we make material changes, we will notify you in-app or by email before they take effect. The "Last updated" date at the top of this page always reflects the current version.

Questions, requests or complaints about privacy? Email hello@track-my-keys.com.